Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inspect archive before extraction #433

Merged
merged 1 commit into from
Oct 15, 2021
Merged

Inspect archive before extraction #433

merged 1 commit into from
Oct 15, 2021

Conversation

yahavi
Copy link
Member

@yahavi yahavi commented Sep 24, 2021

  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • This pull request is on the dev branch.
  • I used gofmt for formatting the code before submitting the pull request.

Resolves #424 by inspecting the archive before extracting it, as suggested by the Archiver maintainer in the library usage:

This package does NOT attempt to mitigate zip-slip attacks ... Our recommendation instead is to inspect the contents of an untrusted archive before extracting it (this package provides Walkers) and decide if you want to proceed with extraction.

@yahavi yahavi requested a review from eyalbe4 September 24, 2021 14:13
@yahavi yahavi self-assigned this Sep 24, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Go Module github.com/mholt/archiver/v3 Flagged with High Security Vulnerability
2 participants